mustflow 2.103.3 → 2.103.12

package/dist/core/ignored-directories.js

@@ -0,0 +1,40 @@
+export const DEFAULT_IGNORED_DIRECTORIES = [
+    '.git',
+    '.mustflow/cache',
+    '.mustflow/state',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.turbo',
+    '.astro',
+];
+function normalizeDirectoryPath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function containsSegmentSequence(segments, sequence) {
+    if (sequence.length === 0 || sequence.length > segments.length) {
+        return false;
+    }
+    for (let index = 0; index <= segments.length - sequence.length; index += 1) {
+        if (sequence.every((segment, offset) => segments[index + offset] === segment)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function isIgnoredDirectoryPath(relativePath, ignoredDirectories = DEFAULT_IGNORED_DIRECTORIES) {
+    const normalized = normalizeDirectoryPath(relativePath);
+    if (normalized === '.') {
+        return false;
+    }
+    const segments = normalized.split('/').filter((segment) => segment.length > 0);
+    return ignoredDirectories.some((entry) => {
+        const ignoredSegments = normalizeDirectoryPath(entry).split('/').filter((segment) => segment.length > 0);
+        if (ignoredSegments.length === 1) {
+            return segments.includes(ignoredSegments[0] ?? '');
+        }
+        return containsSegmentSequence(segments, ignoredSegments);
+    });
+}

package/dist/core/public-json-contracts.js

@@ -495,6 +495,15 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'repo-deploy-surface-report',
+        schemaFile: 'repo-deploy-surface-report.schema.json',
+        producer: 'mf script-pack run repo/deploy-surface inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/deploy-surface', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'config-chain-report',
         schemaFile: 'config-chain-report.schema.json',
@@ -530,6 +539,15 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         installedCommand: ['mf', 'script-pack', 'run', 'repo/secret-risk-scan', 'scan', 'AGENTS.md', '--json'],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'security-pattern-scan-report',
+        schemaFile: 'security-pattern-scan-report.schema.json',
+        producer: 'mf script-pack run repo/security-pattern-scan scan [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/security-pattern-scan', 'scan', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'related-files-report',
         schemaFile: 'related-files-report.schema.json',

package/dist/core/reference-drift.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const REFERENCE_DRIFT_PACK_ID = 'docs';
 export const REFERENCE_DRIFT_SCRIPT_ID = 'reference-drift';
@@ -16,7 +17,7 @@ const CHECKED_REFERENCE_KINDS = [
     'schema_file',
     'repo_path',
 ];
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.astro']);
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'reference_drift_path_outside_root',
     'reference_drift_unreadable_path',
@@ -64,7 +65,7 @@ function addCandidate(candidates, findings, issues, policy, candidate) {
 }
 function collectDocumentsFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
     const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
-    if (IGNORED_DIRECTORIES.has(path.basename(relativeDirectory)) || [...IGNORED_DIRECTORIES].some((entry) => relativeDirectory.startsWith(`${entry}/`))) {
+    if (isIgnoredDirectoryPath(relativeDirectory, IGNORED_DIRECTORIES)) {
         return;
     }
     let entries;
@@ -318,6 +319,7 @@ export function checkReferenceDrift(projectRoot, options) {
         max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
         default_paths: [...DEFAULT_PATHS],
         path_filters: [...PATH_FILTERS],
+        ignored_directories: [...IGNORED_DIRECTORIES],
         checked_reference_kinds: [...CHECKED_REFERENCE_KINDS],
     };
     const commandNames = new Set(options.commandNames);

package/dist/core/related-files.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const RELATED_FILES_PACK_ID = 'repo';
 export const RELATED_FILES_SCRIPT_ID = 'related-files';
@@ -12,17 +13,7 @@ const MAX_ISSUES = 50;
 const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
 const RESOLVE_EXTENSIONS = [...SOURCE_EXTENSIONS, '.json'];
 const RELATED_EXTENSIONS = [...RESOLVE_EXTENSIONS, '.d.ts', '.md', '.mdx', '.css', '.scss', '.sass', '.less'];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const CONFIG_FILE_PATTERNS = [
     /^package\.json$/u,
     /^tsconfig(?:\.[^.]+)?\.json$/u,
@@ -71,8 +62,7 @@ function isSourceLanguage(language) {
     return language !== 'json' && language !== 'other';
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };

package/dist/core/repo-deploy-surface.js

@@ -0,0 +1,428 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+export const REPO_DEPLOY_SURFACE_PACK_ID = 'repo';
+export const REPO_DEPLOY_SURFACE_SCRIPT_ID = 'deploy-surface';
+export const REPO_DEPLOY_SURFACE_SCRIPT_REF = `${REPO_DEPLOY_SURFACE_PACK_ID}/${REPO_DEPLOY_SURFACE_SCRIPT_ID}`;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const WORKFLOW_DIR = '.github/workflows';
+const WORKFLOW_EXTENSIONS = new Set(['.yml', '.yaml']);
+const CONFIG_SURFACES = [
+    {
+        path: 'wrangler.toml',
+        type: 'cloudflare',
+        match: 'wrangler.toml',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'wrangler.json',
+        type: 'cloudflare',
+        match: 'wrangler.json',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'wrangler.jsonc',
+        type: 'cloudflare',
+        match: 'wrangler.jsonc',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'vercel.json',
+        type: 'vercel',
+        match: 'vercel.json',
+        requiredVerification: ['Vercel preview or production deployment verification'],
+        manualGates: ['Vercel project and environment configuration'],
+    },
+    {
+        path: 'netlify.toml',
+        type: 'netlify',
+        match: 'netlify.toml',
+        requiredVerification: ['Netlify deploy preview or production deployment verification'],
+        manualGates: ['Netlify site and environment configuration'],
+    },
+    {
+        path: 'Dockerfile',
+        type: 'container',
+        match: 'Dockerfile',
+        requiredVerification: ['Container build and image smoke verification'],
+        manualGates: ['Container registry credentials and deployment target'],
+    },
+    {
+        path: 'docker-compose.yml',
+        type: 'container',
+        match: 'docker-compose.yml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'docker-compose.yaml',
+        type: 'container',
+        match: 'docker-compose.yaml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'compose.yml',
+        type: 'container',
+        match: 'compose.yml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'compose.yaml',
+        type: 'container',
+        match: 'compose.yaml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+];
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+}
+function lineForOffset(content, offset) {
+    let line = 1;
+    for (let index = 0; index < offset; index += 1) {
+        if (content.charCodeAt(index) === 10) {
+            line += 1;
+        }
+    }
+    return line;
+}
+function firstMatchLine(content, pattern) {
+    const match = pattern.exec(content);
+    if (!match || match.index < 0) {
+        return null;
+    }
+    return {
+        line: lineForOffset(content, match.index),
+        match: match[0].trim(),
+    };
+}
+function uniqueStrings(values) {
+    return [...new Set([...values].filter((value) => value.trim().length > 0))].sort((left, right) => left.localeCompare(right));
+}
+function safeReadText(root, relativePath, maxFileBytes, issues) {
+    const absolute = path.join(root, ...normalizeRelativePath(relativePath).split('/'));
+    try {
+        const stats = statSync(absolute);
+        if (!stats.isFile()) {
+            return null;
+        }
+        if (stats.size > maxFileBytes) {
+            issues.push(`${relativePath} exceeds max_file_bytes (${stats.size} > ${maxFileBytes}).`);
+            return null;
+        }
+        return readFileSync(absolute, 'utf8');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${relativePath}: ${message}`);
+        return null;
+    }
+}
+function listWorkflowFiles(root, issues) {
+    const workflowsPath = path.join(root, ...WORKFLOW_DIR.split('/'));
+    if (!existsSync(workflowsPath)) {
+        return [];
+    }
+    try {
+        return readdirSync(workflowsPath, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && WORKFLOW_EXTENSIONS.has(path.extname(entry.name).toLowerCase()))
+            .map((entry) => `${WORKFLOW_DIR}/${entry.name}`)
+            .sort((left, right) => left.localeCompare(right));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not list ${WORKFLOW_DIR}: ${message}`);
+        return [];
+    }
+}
+function workflowTrigger(content) {
+    const tagPush = firstMatchLine(content, /\btags(?:-ignore)?:\s*(?:\[[^\]]+\]|.+)/u);
+    if (tagPush) {
+        return `tag push (${tagPush.match})`;
+    }
+    const release = firstMatchLine(content, /^\s*release:\s*$/mu);
+    if (release) {
+        return 'GitHub release event';
+    }
+    const workflowDispatch = firstMatchLine(content, /^\s*workflow_dispatch:\s*$/mu);
+    if (workflowDispatch) {
+        return 'manual workflow_dispatch';
+    }
+    const push = firstMatchLine(content, /^\s*push:\s*$/mu);
+    if (push) {
+        return 'push';
+    }
+    return null;
+}
+function workflowManualGates(content, surfaceType) {
+    const gates = [];
+    if (/^\s*environment:\s*/mu.test(content)) {
+        gates.push('GitHub environment protection may gate this workflow.');
+    }
+    if (/^\s*workflow_dispatch:\s*$/mu.test(content)) {
+        gates.push('Manual workflow_dispatch trigger is available.');
+    }
+    if (surfaceType === 'npm_publish') {
+        gates.push('npm trusted publishing, token, or maintainer permission is required.');
+    }
+    if (surfaceType === 'github_pages') {
+        gates.push('GitHub Pages project settings and permissions may gate publication.');
+    }
+    return uniqueStrings(gates);
+}
+function verificationForWorkflow(surfaceType) {
+    if (surfaceType === 'npm_publish') {
+        return ['release_npm_version_available before tag or publish', 'release_npm_published_verify after publish'];
+    }
+    if (surfaceType === 'github_pages') {
+        return ['docs_validate before deploy', 'published Pages URL smoke check after deploy'];
+    }
+    if (surfaceType === 'github_release') {
+        return ['tag workflow run success', 'GitHub Release asset and metadata verification'];
+    }
+    if (surfaceType === 'container') {
+        return ['container image build', 'registry push and runtime smoke verification'];
+    }
+    if (surfaceType === 'cloudflare') {
+        return ['Cloudflare deploy or preview verification'];
+    }
+    if (surfaceType === 'vercel') {
+        return ['Vercel deploy verification'];
+    }
+    if (surfaceType === 'netlify') {
+        return ['Netlify deploy verification'];
+    }
+    return ['deployment workflow run success', 'post-deploy smoke verification'];
+}
+function addWorkflowSurface(seeds, content, relativePath, surfaceType, pattern, matchFallback) {
+    const match = firstMatchLine(content, pattern);
+    if (!match) {
+        return;
+    }
+    seeds.push({
+        kind: 'github_actions_workflow',
+        surfaceType,
+        path: relativePath,
+        line: match.line,
+        trigger: workflowTrigger(content),
+        confidence: surfaceType === 'generic_deploy' ? 'medium' : 'high',
+        match: match.match || matchFallback,
+        requiredVerification: verificationForWorkflow(surfaceType),
+        manualGates: workflowManualGates(content, surfaceType),
+    });
+}
+function scanWorkflowFile(root, relativePath, maxFileBytes, seeds, issues) {
+    const content = safeReadText(root, relativePath, maxFileBytes, issues);
+    if (content === null) {
+        return;
+    }
+    addWorkflowSurface(seeds, content, relativePath, 'npm_publish', /\b(?:npm|bun|pnpm)\s+publish\b|yarn\s+npm\s+publish\b|JS-DevTools\/npm-publish/u, 'npm publish');
+    addWorkflowSurface(seeds, content, relativePath, 'github_pages', /actions\/deploy-pages|pages:\s*write|github-pages|pages\.github\.io/u, 'GitHub Pages deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'github_release', /softprops\/action-gh-release|gh\s+release\b|actions\/create-release|create-release/u, 'GitHub release');
+    addWorkflowSurface(seeds, content, relativePath, 'container', /docker\/build-push-action|\bdocker\s+(?:build|push)\b|ghcr\.io|container_registry/u, 'container build or push');
+    addWorkflowSurface(seeds, content, relativePath, 'cloudflare', /cloudflare\/wrangler-action|\bwrangler\s+deploy\b/u, 'Cloudflare deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'vercel', /\bvercel\s+(?:deploy|--prod)\b/u, 'Vercel deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'netlify', /\bnetlify\s+deploy\b|actions-netlify/u, 'Netlify deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'generic_deploy', /\bdeploy(?:ment)?\b/u, 'deploy');
+}
+function scanPackageJson(root, maxFileBytes, seeds, issues) {
+    const relativePath = 'package.json';
+    if (!existsSync(path.join(root, relativePath))) {
+        return;
+    }
+    const content = safeReadText(root, relativePath, maxFileBytes, issues);
+    if (content === null) {
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not parse ${relativePath}: ${message}`);
+        return;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        issues.push(`${relativePath} must contain a JSON object.`);
+        return;
+    }
+    const record = parsed;
+    const scripts = record.scripts;
+    if (scripts && typeof scripts === 'object' && !Array.isArray(scripts)) {
+        for (const [scriptName, scriptValue] of Object.entries(scripts)) {
+            if (typeof scriptValue !== 'string') {
+                continue;
+            }
+            const lowerName = scriptName.toLowerCase();
+            const lowerValue = scriptValue.toLowerCase();
+            const releaseLike = /(?:^|:)(?:deploy|release|publish|prepublishonly|postpublish)$/u.test(lowerName);
+            const commandLike = /\b(?:npm|bun|pnpm)\s+publish\b|yarn\s+npm\s+publish\b|\b(?:wrangler|vercel|netlify)\s+deploy\b|\bgh\s+release\b/u.test(lowerValue);
+            if (!releaseLike && !commandLike) {
+                continue;
+            }
+            const surfaceType = lowerValue.includes('wrangler')
+                ? 'cloudflare'
+                : lowerValue.includes('vercel')
+                    ? 'vercel'
+                    : lowerValue.includes('netlify')
+                        ? 'netlify'
+                        : lowerName.includes('publish') || lowerValue.includes('publish')
+                            ? 'npm_publish'
+                            : lowerName.includes('release') || lowerValue.includes('gh release')
+                                ? 'package_release'
+                                : 'generic_deploy';
+            const line = firstMatchLine(content, new RegExp(`"${scriptName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}"\\s*:`, 'u'));
+            seeds.push({
+                kind: 'package_script',
+                surfaceType,
+                path: relativePath,
+                line: line?.line ?? null,
+                trigger: `package script: ${scriptName}`,
+                confidence: commandLike ? 'high' : 'medium',
+                match: `${scriptName}: ${scriptValue}`,
+                requiredVerification: verificationForWorkflow(surfaceType),
+                manualGates: surfaceType === 'npm_publish'
+                    ? ['npm trusted publishing, token, or maintainer permission is required.']
+                    : [],
+            });
+        }
+    }
+    if (typeof record.name === 'string' &&
+        typeof record.version === 'string' &&
+        record.private !== true &&
+        (record.publishConfig || record.bin || record.exports)) {
+        const line = firstMatchLine(content, /"publishConfig"|"bin"|"exports"/u);
+        seeds.push({
+            kind: 'package_metadata',
+            surfaceType: 'npm_publish',
+            path: relativePath,
+            line: line?.line ?? null,
+            trigger: 'package metadata',
+            confidence: record.publishConfig ? 'high' : 'medium',
+            match: line?.match ?? 'publishable package metadata',
+            requiredVerification: ['release_npm_version_available before publish', 'release_npm_published_verify after publish'],
+            manualGates: ['npm trusted publishing, token, or maintainer permission is required.'],
+        });
+    }
+}
+function scanConfigSurfaces(root, seeds) {
+    for (const candidate of CONFIG_SURFACES) {
+        if (!existsSync(path.join(root, ...candidate.path.split('/')))) {
+            continue;
+        }
+        seeds.push({
+            kind: 'deploy_config',
+            surfaceType: candidate.type,
+            path: candidate.path,
+            line: null,
+            trigger: null,
+            confidence: 'medium',
+            match: candidate.match,
+            requiredVerification: candidate.requiredVerification,
+            manualGates: candidate.manualGates,
+        });
+    }
+}
+function seedId(seed, index) {
+    return `${seed.kind}:${seed.surfaceType}:${seed.path}:${seed.line ?? 0}:${index}`;
+}
+function toSurface(seed, index) {
+    return {
+        id: seedId(seed, index),
+        kind: seed.kind,
+        surface_type: seed.surfaceType,
+        path: seed.path,
+        line: seed.line,
+        trigger: seed.trigger,
+        confidence: seed.confidence,
+        evidence: {
+            path: seed.path,
+            line: seed.line,
+            match: seed.match,
+        },
+        required_verification: uniqueStrings(seed.requiredVerification),
+        manual_gates: uniqueStrings(seed.manualGates),
+    };
+}
+function createFindings(surfaces) {
+    return surfaces.map((surface) => ({
+        code: 'deploy_surface_detected',
+        severity: surface.confidence === 'high' ? 'medium' : 'low',
+        path: surface.path,
+        message: `Detected ${surface.surface_type} deploy surface in ${surface.path}.`,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    }));
+}
+function createSummary(surfaces) {
+    return {
+        has_deploy_surface: surfaces.length > 0,
+        surface_count: surfaces.length,
+        workflow_count: surfaces.filter((surface) => surface.kind === 'github_actions_workflow').length,
+        package_script_count: surfaces.filter((surface) => surface.kind === 'package_script').length,
+        config_file_count: surfaces.filter((surface) => surface.kind === 'deploy_config').length,
+        package_metadata_count: surfaces.filter((surface) => surface.kind === 'package_metadata').length,
+        manual_gate_count: uniqueStrings(surfaces.flatMap((surface) => surface.manual_gates)).length,
+        required_verification_count: uniqueStrings(surfaces.flatMap((surface) => surface.required_verification)).length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function inspectRepoDeploySurface(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const issues = [];
+    const maxFileBytes = DEFAULT_MAX_FILE_BYTES;
+    const scannedPaths = new Set();
+    const seeds = [];
+    for (const workflowPath of listWorkflowFiles(root, issues)) {
+        scannedPaths.add(workflowPath);
+        scanWorkflowFile(root, workflowPath, maxFileBytes, seeds, issues);
+    }
+    scannedPaths.add('package.json');
+    scanPackageJson(root, maxFileBytes, seeds, issues);
+    for (const candidate of CONFIG_SURFACES) {
+        scannedPaths.add(candidate.path);
+    }
+    scanConfigSurfaces(root, seeds);
+    const surfaces = seeds.map(toSurface).sort((left, right) => left.path.localeCompare(right.path) || left.id.localeCompare(right.id));
+    const summary = createSummary(surfaces);
+    const requiredVerification = uniqueStrings(surfaces.flatMap((surface) => surface.required_verification));
+    const manualGates = uniqueStrings(surfaces.flatMap((surface) => surface.manual_gates));
+    const findings = createFindings(surfaces);
+    const status = issues.length > 0 ? 'error' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_DEPLOY_SURFACE_PACK_ID,
+        script_id: REPO_DEPLOY_SURFACE_SCRIPT_ID,
+        script_ref: REPO_DEPLOY_SURFACE_SCRIPT_REF,
+        action: 'inspect',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            scanned_paths: uniqueStrings(scannedPaths),
+            max_file_bytes: maxFileBytes,
+        },
+        input_hash: createInputHash({ summary, surfaces, requiredVerification, manualGates, findings, issues }),
+        has_deploy_surface: summary.has_deploy_surface,
+        summary,
+        surfaces,
+        required_verification: requiredVerification,
+        manual_gates: manualGates,
+        findings,
+        issues,
+    };
+}

package/dist/core/repo-merge-conflict-scan.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { existsSync, lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const REPO_MERGE_CONFLICT_SCAN_PACK_ID = 'repo';
 export const REPO_MERGE_CONFLICT_SCAN_SCRIPT_ID = 'merge-conflict-scan';
@@ -15,15 +16,9 @@ const MARKER_PATTERNS = [
     { prefix: '>>>>>>>', marker: 'end' },
 ];
 const SKIPPED_DIRECTORY_NAMES = new Set([
-    '.git',
-    'node_modules',
+    ...DEFAULT_IGNORED_DIRECTORIES,
     'vendor',
     'third_party',
-    'dist',
-    'build',
-    'coverage',
-    '.mustflow/cache',
-    '.mustflow/state',
 ]);
 function normalizeRelativePath(value) {
     return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
@@ -95,8 +90,7 @@ function collectGitChangedFiles(root, issues, findings) {
 }
 function shouldSkipDirectory(relativePath) {
     const normalized = normalizeRelativePath(relativePath);
-    const firstSegment = normalized.split('/')[0] ?? normalized;
-    return SKIPPED_DIRECTORY_NAMES.has(normalized) || SKIPPED_DIRECTORY_NAMES.has(firstSegment);
+    return isIgnoredDirectoryPath(normalized, [...SKIPPED_DIRECTORY_NAMES]);
 }
 function isLikelyTextFile(relativePath) {
     const extension = path.posix.extname(relativePath).toLowerCase();

package/dist/core/route-outline.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { lstatSync, readdirSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
 import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
 export const CODE_ROUTE_OUTLINE_SCRIPT_ID = 'route-outline';
 export const CODE_ROUTE_OUTLINE_SCRIPT_REF = `code/${CODE_ROUTE_OUTLINE_SCRIPT_ID}`;
@@ -39,17 +40,7 @@ const LIFECYCLE_METHODS = [
     'onAfterHandle',
     'onError',
 ];
-const IGNORED_DIRECTORIES = [
-    '.git',
-    '.mustflow/cache',
-    '.mustflow/state',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    '.next',
-    '.turbo',
-];
+const IGNORED_DIRECTORIES = DEFAULT_IGNORED_DIRECTORIES;
 const ERROR_CODES = new Set([
     'code_route_outline_path_outside_root',
     'code_route_outline_unreadable_path',
@@ -85,8 +76,7 @@ function languageForPath(filePath) {
     }
 }
 function isIgnoredDirectory(relativePath) {
-    const normalized = normalizeRelativePath(relativePath);
-    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), IGNORED_DIRECTORIES);
 }
 function makeFinding(code, severity, pathValue, message) {
     return { code, severity, path: pathValue, message };